Before Disaster Strikes

Find Out How You Can Get Ready

Feb 25, 2013 – by Dave Vagnoni

Are you prepared for a major business disruption? A flood? Blackout? Fire? Data loss? Keep reading to find out how you can get ready.

Before a hurricane barreled through Freeport, NY, in 2011, David Miller prepared his company the best he could. "We tried to block any potential risk areas," Miller remembers. "The next day, we came in and there was nominal impact on the facility, but nothing that impacted our customers."

That storm – Hurricane Irene – was an historic event for Long Island. Nearly 500,000 people lost power and flooded roads were more easily navigated by kayaks than cars. It was a once-in-a-generation storm – until Hurricane Sandy arrived 14 months later.

"We did the same kind of preparations and we expected the same kind of minimal impact," says Miller, the president of supplier Chocolate Inn/Taylor & Grant (asi/44900). "We came in the next day and the damage was horrific."

Heavy rain and storm surge had left five feet of saltwater in Chocolate Inn's factory, destroying millions of dollars of pre-holiday inventory. Sixty-five production machines were seriously damaged and 35 scanning computers were completely ruined.

"When I walked in, it looked like there had been a tornado," Miller says. "There was not a spot in the factory that was untouched. We had significant water damage and boxes were everywhere. A hi-lo that weighed several thousand pounds had moved about 20 feet from where it was the night before."

As if things weren't challenging enough, Sandy struck near the end of October, at the beginning of Chocolate Inn's busiest season. The company endured 10 days without electricity and telephone service, losing 38 production shifts over nearly three weeks. Despite around-the-clock remediation efforts, the supplier wasn't able to send out orders again until late November. "We expedited shipping," Miller says, "and about 99% of holiday orders got to customers before Christmas. We never want to disappoint a customer. We worked 24/7."

Finally, on January 1, after an exhausting two months, Chocolate Inn resumed a normal production schedule. "Right now, we're in a good place," Miller says. "Customers have been really understanding. We have a tremendous team and we're hopeful 2013 will be a year of growth. I don't know what else we could've done to prepare for the hurricane. I feel like we did all we could."

Experts agree that Sandy was so devastating to Freeport that even drastic preparation wouldn't have spared Chocolate Inn from crippling damage. But, experts also say, most business interruptions are nothing like Sandy, and the majority of incidents can be mitigated with the proper planning. Here's a breakdown of steps you can take to survive a business disaster.

Assess Risks
According to the Federal Emergency Management Agency, up to 40% of businesses affected by a natural or man-made disaster never reopen. "A lot of businesspeople cross their fingers, look the other way and hope," says William Wagner, III, president of disaster management firm Early Alert. "Businesses need to understand their vulnerabilities and make a plan to mitigate issues."

Consultants suggest conducting a vulnerability analysis – a fancy way of figuring out the risks your business faces. The analysis doesn't need to be complicated and can be outlined on a single sheet of paper. It's important, though, to take into account more than just geography and past history when you assess risks.

Obviously, if your business is located in Oklahoma County, OK – which has been directly hit by tornados 101 times since 1950 – then twisters are a huge threat to your business' continuity. But it's sometimes easy to forget other potential dangers. "If you have water pipes above the ceiling of your server room, that needs to go in your assessment, too," says Kim Godfrey, security consultant at Austin-based Spohn Solutions.

What are some other common risks you may not think of? Experts advise looking at local crime stats (to gauge burglary threats), proximity to landmarks or transportation hubs (terrorism), chemicals used by nearby manufacturers (explosions) and lax network security policies (data breaches).

Once you make a list of vulnerabilities, experts say you should determine how to shore up trouble spots. Maybe you've realized only one member of your staff knows how to reset a piece of machinery. What happens if that person suddenly can't make it to work for a week, or a month? As a remedy, experts suggest documenting instructions for essential business functions and involving multiple employees in the process. "Cross-training is very important because you can't always be sure all employees will come back," Godfrey says. "Writing something and following up on it are two different things."

As you consider risks to your company, though, don't overwhelm yourself with every possible weakness. Instead, focus on a few key areas that must be reinforced to keep your company operational if a major event occurs. "You have to build in contingencies," says Carol Chastang, a spokesperson for the U.S. Small Business Administration (SBA). "You really want to ask yourself how long you can withstand an interruption."

As a good rule of thumb, unless your business suffers a crippling event – like an earthquake that affects an entire region – your company should be responsive to customer needs within a few hours following an incident. For a supplier, that might mean having enough inventory off-site to manage a day's worth of orders. For a distributor, that might mean being able to access customer records through a cloud-based server.

Create an Action Plan
In the event of a serious business emergency, like a fire, your staff has to be able to respond quickly. With just a little training, each employee should be able to answer these two questions: Where do I go in an evacuation? And, what's my role in keeping our business functioning? "Training doesn't have to get in the way of an entire work day," Godfrey says. "Just do a table-top test and see if your staff can talk you through a process."

Work with your local fire department to develop the best evacuation plan for your office. Be sure to tell officials if anyone on your staff is disabled because that might require a different exit approach. As you consider continuity, experts advise delegating responsibilities to cover these areas: preserving critical documents, restoring systems functionality, alerting customers, evaluating damage and managing personnel. "It's one thing to have a plan and it's another thing to put a plan in place," Wagner says.

If, by now, you're thinking you don't have the time for thorough risk assessments and continuity planning, you can still make basic preparations by being practical. For example, you may want to invest $150 and buy a fireproof safe to hold paperwork, especially insurance files. Consider expanding your list of vendors as well, making sure you can source items from various geographic areas in the event of a big winter storm that might hamper normal shipping. Also, think about alternative work areas in case your office is temporarily unusable.

"Make an agreement with a neighboring business that would allow you to share their space," Chastang says. "Contact realtors and see what vacant office spaces are available. Some property owners are desperate to rent."

If your office is in a high-crime area and you can't afford a security system, make sure to at least have working motion-detecting lights at each entrance. The motion sensors can give the appearance that your security is tighter than it is. It's also smart to keep an emergency kit handy and restock it every six months. The kit might include first-aid supplies, a flashlight, a battery-powered radio, bottled water, nonperishable food and a printed contact list for hospitals and disaster relief agencies.

Finally, put away some emergency cash – enough to replace a key piece of equipment, pay employees for overtime or to begin cleanup efforts. "Even a small amount of cash reserves can help your business function during the recovery phase," Chastang says. "Calculate what your losses would be for one week out of business and start there."

Don't Forget About Data
Consultant Philip Jan Rothstein admits he's pretty meticulous when it comes to backing up his company's data. He uses nine levels of backup, including security that's outside of North America. Sounds expensive, right? "It costs me pennies a day," he says. "So much can be done on the cloud."

Because the marketplace is littered with so many cloud-based storage providers, it's now fairly common to pay $10 per month to back up data on several computers, plus mobile devices.
Some, though, still want to avoid cloud storage for fear of the access it could give others to your company's information. Then what?

"Back up your files through a thumb drive," Rothstein says. Godfrey recommends only using USB drives that are encrypted, though, especially if you're storing sensitive information. "USB sticks tend to get lost," she says.

Of course, data security doesn't end with storage. Installing and updating anti-virus software throughout your network (and on your personal laptop) is critical to warding off hackers and blocking malware. It's also a good idea to only work over secure networks, meaning using Wi-Fi in public places, like a coffee shop or an airport, should be off limits to your staff.

"A lot of this comes down to common sense," Rothstein says. "Unfortunately, though, sometimes people are just in denial about what they should do."

Crisis Communications
In the chaos of a business interruption, it can be easy to overlook the significance of good communication. That's where solid planning can make all the difference. In the event of an emergency, have a communications checklist ready to go. "First, you'll want to notify staff, customers and vendors of what's happened," says Chastang. "Keep a current phone tree and have a list of e-mail addresses and cell numbers."

If your company's phone lines are down, you'll also want to contact your provider as soon as possible. Have incoming calls redirected to a cell phone or to a call center. If your business is a prominent local company, you should designate a spokesperson to handle media requests. "Train this person on how to talk to reporters," Chastang says. "You don't have to tell reporters everything because your competitors might be listening."

Once the initial wave of attention rolls past, your next challenge will be perception.
If you have a storefront property and you can't open your doors for a while, people in your community might think your business is closed for good. "Assumptions are made and word spreads," Chastang says. "Think about creating a Facebook page or going on Twitter to provide real-time updates on when you'll reopen."

Understanding Insurance Options
A key to preventing a major disruption from ruining your business is holding property insurance. Not only does property insurance cover facilities, it can also protect furniture, inventory and computers. "Property insurance may also include coverage for equipment breakdown, removal of debris and some types of water damage," says Loretta Wolters, vice president of communications at the Insurance Information Institute.

Be warned, though – standard property insurance does not cover flooding. That requires a special policy. Also know that while property insurance is the most well-known type of business coverage, there are other policies that you should strongly consider purchasing as well. Liability insurance, for example, protects against defective product lawsuits, paying for damages, legal fees and the medical bills of anyone injured.

A third type of coverage – workers' compensation insurance – is required once your business expands beyond a couple of employees. "Workers' comp insurance pays for medical care and replaces a portion of lost wages for an employee, regardless of who was at fault," Wolters says.

What if your business is home-based, though? Wolters suggests three ways to strengthen your homeowners' coverage. The first option is to add an endorsement to your current policy, which can typically double your coverage limits. Another idea is to purchase what's called an in-home business policy, a type of coverage that can reimburse you for income losses. Also available is a business owner policy, a coverage designed for small-to-mid-size companies. "This policy," Wolters says, "is an excellent solution if your home-based business operates in more than one location."